As an additional effort and level of protection against DDoS attacks, following on from AWS WAF and AWS Shield, it is also recommended, where feasible when serving web traffic, to use AWS-managed edge services such as AWS CloudFront and Amazon Route 53. AWS Shield integration with these edge services allows the architecture and AWS services to detect and mitigate potential DDoS attacks down to a sub-second level, significantly decreasing the chances of compromise.
Both Amazon CloudFront (with AWS WAF) and Route 53 offer the following protections:
- Layer 3, layer 4, and layer 7 attack mitigation (for example, UDP reflection, SYN floods, and application-layer attacks).
- Being managed services, they are able to scale to absorb the additional traffic generated from application-layer attacks and so reduce the impact on your infrastructure.
- They are able to provide geo-location and the dispersion of additional traffic from larger DDoS attacks.
Amazon CloudFront...
